wyvrnpm 2.10.2 → 2.12.2

package/src/build/clone.js

@@ -1,170 +1,170 @@
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { spawn } = require('child_process');
-
-const log = require('../logger');
-
-/**
- * Spawn a command with inherited stdio, resolve on exit 0, reject otherwise.
- *
- * @param {string}   cmd
- * @param {string[]} args
- * @param {{ cwd?: string }} [opts]
- * @returns {Promise<void>}
- */
-function run(cmd, args, opts = {}) {
-  return new Promise((resolve, reject) => {
-    const proc = spawn(cmd, args, { stdio: 'inherit', ...opts });
-    proc.on('error', (err) => reject(new Error(
-      `Failed to spawn ${cmd}: ${err.message} (is it installed and on PATH?)`,
-    )));
-    proc.on('close', (code) => {
-      if (code === 0) resolve();
-      else reject(new Error(`${cmd} ${args.join(' ')} exited ${code}`));
-    });
-  });
-}
-
-/**
- * Ensure `gitRepo` is cloned into `destDir` at commit `gitSha`.
- *
- * Semantics:
- *   - If destDir does not exist → fresh clone + checkout gitSha.
- *   - If destDir exists and the HEAD commit already matches gitSha → no-op.
- *   - If destDir exists with a different HEAD → fetch + checkout the right
- *     SHA, reusing already-downloaded git objects.
- *   - If reuse fails for any reason (corrupted cache, unreachable SHA),
- *     blow away the cache and fresh-clone.
- *
- * Each path tries a fast shallow fetch by SHA first, then falls back to a
- * full fetch. Some git servers disable `uploadpack.allowReachableSHA1InWant`
- * (notably older Bitbucket Server installs), which makes direct SHA fetches
- * fail with "upload-pack: not our ref"; the full-fetch fallback handles it.
- *
- * Credentials are delegated entirely to the user's ambient git config
- * (SSH keys, credential helpers). We do NOT manage auth.
- *
- * @param {{ gitRepo: string, gitSha: string, destDir: string }} args
- * @returns {Promise<void>}
- */
-async function cloneAtSha({ gitRepo, gitSha, destDir }) {
-  if (!gitRepo) throw new Error('cloneAtSha: gitRepo is required');
-  if (!gitSha)  throw new Error('cloneAtSha: gitSha is required');
-
-  // Reuse existing clone if possible.
-  if (fs.existsSync(path.join(destDir, '.git'))) {
-    try {
-      await reuseExistingClone({ destDir, gitSha, gitRepo });
-      return;
-    } catch (err) {
-      // An unreachable-commit error is fatal and won't be helped by rebuilding.
-      if (/not reachable/.test(err.message)) throw err;
-      log.warn(`  cached clone unusable (${err.message}); rebuilding`);
-      fs.rmSync(destDir, { recursive: true, force: true });
-    }
-  }
-
-  await freshClone({ gitRepo, gitSha, destDir });
-}
-
-/**
- * Verify that `gitSha` is present and reachable in `destDir`. Throws with an
- * actionable error message when it isn't — the common root cause is an
- * unpushed publisher-side commit or a feature branch that was deleted after
- * publish, leaving the commit dangling on origin.
- */
-async function verifyShaPresent({ destDir, gitSha, gitRepo }) {
-  try {
-    await run('git', ['cat-file', '-e', `${gitSha}^{commit}`], { cwd: destDir });
-  } catch {
-    throw new Error(
-      `commit ${gitSha.slice(0, 12)} is not reachable from any branch or tag on ${gitRepo}. ` +
-      `Likely cause: the publisher's HEAD was not pushed, OR the commit was on a ` +
-      `feature branch that was deleted/squash-merged after publish. ` +
-      `Fix: the package maintainer should republish from a commit that is pushed ` +
-      `and reachable from a remote branch or tag.`,
-    );
-  }
-}
-
-/**
- * Checkout `gitSha` in an existing clone. Tries shallow-SHA fetch first,
- * then full fetch (+ tags), then verifies reachability before checkout.
- */
-async function reuseExistingClone({ destDir, gitSha, gitRepo }) {
-  const current = await getHeadSha(destDir);
-  if (current === gitSha) return;
-
-  log.info(`  reusing existing clone, switching to ${gitSha.slice(0, 12)}`);
-  try {
-    // Fast path: shallow fetch the specific SHA directly.
-    await run('git', ['fetch', '--depth', '1', 'origin', gitSha], { cwd: destDir });
-  } catch {
-    // Fallback: full fetch + tags. Fetching tags catches commits that live
-    // only under `refs/tags/*` — e.g. a release commit whose branch was
-    // deleted but whose tag remains.
-    log.info('  shallow SHA fetch unsupported by server; fetching all refs + tags (slower)');
-    await run('git', ['fetch', '--tags', 'origin'], { cwd: destDir });
-  }
-  await verifyShaPresent({ destDir, gitSha, gitRepo });
-  await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
-}
-
-/**
- * Fresh clone. Tries `init + remote add + shallow-fetch <sha>` first, falls
- * back to a full `git clone --tags` if the server refuses direct-SHA
- * fetches. Verifies the commit is reachable before attempting checkout so
- * the failure mode is a clear error rather than a cryptic `unable to read
- * tree`.
- */
-async function freshClone({ gitRepo, gitSha, destDir }) {
-  fs.mkdirSync(destDir, { recursive: true });
-  log.info(`  cloning ${gitRepo} at ${gitSha.slice(0, 12)} → ${destDir}`);
-  try {
-    await run('git', ['init', '--quiet'], { cwd: destDir });
-    await run('git', ['remote', 'add', 'origin', gitRepo], { cwd: destDir });
-    await run('git', ['fetch', '--depth', '1', 'origin', gitSha], { cwd: destDir });
-    await verifyShaPresent({ destDir, gitSha, gitRepo });
-    await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
-  } catch (err) {
-    // If the shallow-SHA fetch itself failed (server refuses it), fall
-    // through to a full clone. If instead the SHA-reachability check failed,
-    // re-throw with the actionable message — a full clone wouldn't help.
-    if (/not reachable/.test(err.message)) throw err;
-
-    log.warn(`  shallow fetch by SHA failed (${err.message}); falling back to full clone`);
-    fs.rmSync(destDir, { recursive: true, force: true });
-    fs.mkdirSync(destDir, { recursive: true });
-    // `--tags` brings down tag refs in the same round-trip so tag-only
-    // commits are reachable too.
-    await run('git', ['clone', '--quiet', '--tags', gitRepo, '.'], { cwd: destDir });
-    await verifyShaPresent({ destDir, gitSha, gitRepo });
-    await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
-  }
-}
-
-/**
- * Return the current HEAD commit SHA of a git working tree, or null on error.
- * @param {string} dir
- * @returns {Promise<string|null>}
- */
-function getHeadSha(dir) {
-  return new Promise((resolve) => {
-    const proc = spawn('git', ['rev-parse', 'HEAD'], {
-      cwd: dir,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    });
-    let out = '';
-    proc.stdout.on('data', (c) => { out += c.toString(); });
-    proc.on('error', () => resolve(null));
-    proc.on('close', (code) => {
-      if (code !== 0) return resolve(null);
-      const sha = out.trim();
-      resolve(/^[0-9a-f]{40}$/i.test(sha) ? sha : null);
-    });
-  });
-}
-
-module.exports = { cloneAtSha, getHeadSha };
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const log = require('../logger');
+
+/**
+ * Spawn a command with inherited stdio, resolve on exit 0, reject otherwise.
+ *
+ * @param {string}   cmd
+ * @param {string[]} args
+ * @param {{ cwd?: string }} [opts]
+ * @returns {Promise<void>}
+ */
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn(cmd, args, { stdio: 'inherit', ...opts });
+    proc.on('error', (err) => reject(new Error(
+      `Failed to spawn ${cmd}: ${err.message} (is it installed and on PATH?)`,
+    )));
+    proc.on('close', (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`${cmd} ${args.join(' ')} exited ${code}`));
+    });
+  });
+}
+
+/**
+ * Ensure `gitRepo` is cloned into `destDir` at commit `gitSha`.
+ *
+ * Semantics:
+ *   - If destDir does not exist → fresh clone + checkout gitSha.
+ *   - If destDir exists and the HEAD commit already matches gitSha → no-op.
+ *   - If destDir exists with a different HEAD → fetch + checkout the right
+ *     SHA, reusing already-downloaded git objects.
+ *   - If reuse fails for any reason (corrupted cache, unreachable SHA),
+ *     blow away the cache and fresh-clone.
+ *
+ * Each path tries a fast shallow fetch by SHA first, then falls back to a
+ * full fetch. Some git servers disable `uploadpack.allowReachableSHA1InWant`
+ * (notably older Bitbucket Server installs), which makes direct SHA fetches
+ * fail with "upload-pack: not our ref"; the full-fetch fallback handles it.
+ *
+ * Credentials are delegated entirely to the user's ambient git config
+ * (SSH keys, credential helpers). We do NOT manage auth.
+ *
+ * @param {{ gitRepo: string, gitSha: string, destDir: string }} args
+ * @returns {Promise<void>}
+ */
+async function cloneAtSha({ gitRepo, gitSha, destDir }) {
+  if (!gitRepo) throw new Error('cloneAtSha: gitRepo is required');
+  if (!gitSha)  throw new Error('cloneAtSha: gitSha is required');
+
+  // Reuse existing clone if possible.
+  if (fs.existsSync(path.join(destDir, '.git'))) {
+    try {
+      await reuseExistingClone({ destDir, gitSha, gitRepo });
+      return;
+    } catch (err) {
+      // An unreachable-commit error is fatal and won't be helped by rebuilding.
+      if (/not reachable/.test(err.message)) throw err;
+      log.warn(`  cached clone unusable (${err.message}); rebuilding`);
+      fs.rmSync(destDir, { recursive: true, force: true });
+    }
+  }
+
+  await freshClone({ gitRepo, gitSha, destDir });
+}
+
+/**
+ * Verify that `gitSha` is present and reachable in `destDir`. Throws with an
+ * actionable error message when it isn't — the common root cause is an
+ * unpushed publisher-side commit or a feature branch that was deleted after
+ * publish, leaving the commit dangling on origin.
+ */
+async function verifyShaPresent({ destDir, gitSha, gitRepo }) {
+  try {
+    await run('git', ['cat-file', '-e', `${gitSha}^{commit}`], { cwd: destDir });
+  } catch {
+    throw new Error(
+      `commit ${gitSha.slice(0, 12)} is not reachable from any branch or tag on ${gitRepo}. ` +
+      `Likely cause: the publisher's HEAD was not pushed, OR the commit was on a ` +
+      `feature branch that was deleted/squash-merged after publish. ` +
+      `Fix: the package maintainer should republish from a commit that is pushed ` +
+      `and reachable from a remote branch or tag.`,
+    );
+  }
+}
+
+/**
+ * Checkout `gitSha` in an existing clone. Tries shallow-SHA fetch first,
+ * then full fetch (+ tags), then verifies reachability before checkout.
+ */
+async function reuseExistingClone({ destDir, gitSha, gitRepo }) {
+  const current = await getHeadSha(destDir);
+  if (current === gitSha) return;
+
+  log.info(`  reusing existing clone, switching to ${gitSha.slice(0, 12)}`);
+  try {
+    // Fast path: shallow fetch the specific SHA directly.
+    await run('git', ['fetch', '--depth', '1', 'origin', gitSha], { cwd: destDir });
+  } catch {
+    // Fallback: full fetch + tags. Fetching tags catches commits that live
+    // only under `refs/tags/*` — e.g. a release commit whose branch was
+    // deleted but whose tag remains.
+    log.info('  shallow SHA fetch unsupported by server; fetching all refs + tags (slower)');
+    await run('git', ['fetch', '--tags', 'origin'], { cwd: destDir });
+  }
+  await verifyShaPresent({ destDir, gitSha, gitRepo });
+  await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
+}
+
+/**
+ * Fresh clone. Tries `init + remote add + shallow-fetch <sha>` first, falls
+ * back to a full `git clone --tags` if the server refuses direct-SHA
+ * fetches. Verifies the commit is reachable before attempting checkout so
+ * the failure mode is a clear error rather than a cryptic `unable to read
+ * tree`.
+ */
+async function freshClone({ gitRepo, gitSha, destDir }) {
+  fs.mkdirSync(destDir, { recursive: true });
+  log.info(`  cloning ${gitRepo} at ${gitSha.slice(0, 12)} → ${destDir}`);
+  try {
+    await run('git', ['init', '--quiet'], { cwd: destDir });
+    await run('git', ['remote', 'add', 'origin', gitRepo], { cwd: destDir });
+    await run('git', ['fetch', '--depth', '1', 'origin', gitSha], { cwd: destDir });
+    await verifyShaPresent({ destDir, gitSha, gitRepo });
+    await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
+  } catch (err) {
+    // If the shallow-SHA fetch itself failed (server refuses it), fall
+    // through to a full clone. If instead the SHA-reachability check failed,
+    // re-throw with the actionable message — a full clone wouldn't help.
+    if (/not reachable/.test(err.message)) throw err;
+
+    log.warn(`  shallow fetch by SHA failed (${err.message}); falling back to full clone`);
+    fs.rmSync(destDir, { recursive: true, force: true });
+    fs.mkdirSync(destDir, { recursive: true });
+    // `--tags` brings down tag refs in the same round-trip so tag-only
+    // commits are reachable too.
+    await run('git', ['clone', '--quiet', '--tags', gitRepo, '.'], { cwd: destDir });
+    await verifyShaPresent({ destDir, gitSha, gitRepo });
+    await run('git', ['checkout', '--detach', gitSha], { cwd: destDir });
+  }
+}
+
+/**
+ * Return the current HEAD commit SHA of a git working tree, or null on error.
+ * @param {string} dir
+ * @returns {Promise<string|null>}
+ */
+function getHeadSha(dir) {
+  return new Promise((resolve) => {
+    const proc = spawn('git', ['rev-parse', 'HEAD'], {
+      cwd: dir,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    let out = '';
+    proc.stdout.on('data', (c) => { out += c.toString(); });
+    proc.on('error', () => resolve(null));
+    proc.on('close', (code) => {
+      if (code !== 0) return resolve(null);
+      const sha = out.trim();
+      resolve(/^[0-9a-f]{40}$/i.test(sha) ? sha : null);
+    });
+  });
+}
+
+module.exports = { cloneAtSha, getHeadSha };